orez-sync-cf-host 0.16.14 → 0.16.15

package/dist/host.js

@@ -22,6 +22,26 @@ const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
 const MIN_SNAPSHOT_PAGE_ROWS = 100;
 const WORKER_STAGE_TELEMETRY_SAMPLE_RATE = 0.01;
 const WORKER_STAGE_WAITING_MS = 5_000;
+// a feed that STOPS publishing a table this replica already syncs is a
+// publication misconfiguration, and it is invisible otherwise: the page applies
+// nothing, the cursor still advances on the trailing syncCursor marker, and
+// every query keeps answering from the last row that made it through, so
+// clients see a table frozen at the moment of the bad deploy with no error
+// anywhere.
+//
+// an app may also model tables it deliberately never publishes, capturing them
+// for rollback only. in any single page those look identical to a demotion, so
+// the test is not "modelled but dropped" but "dropped after this replica had
+// already been receiving it": compare against the tables this replica has
+// actually ingested and name only the ones that left.
+function unpublishedRegressions(batch, schema, publishedSeen) {
+    const reported = batch.unpublishedTables;
+    if (!Array.isArray(reported) || reported.length === 0)
+        return [];
+    return reported.filter((table) => typeof table === 'string' &&
+        Object.hasOwn(schema.tables, table) &&
+        publishedSeen.has(table));
+}
 function upstreamBatchTables(batch) {
     const tables = new Set();
     for (const change of batch.changes) {
@@ -632,7 +652,8 @@ export function createSyncDurableObject(config) {
                 }
                 const ingestBreakerReason = this.#controlGet('ingestBreakerReason');
                 if (ingestBreakerReason === 'ingestBudgetExceeded' ||
-                    ingestBreakerReason === 'ingestCursorStalled') {
+                    ingestBreakerReason === 'ingestCursorStalled' ||
+                    ingestBreakerReason === 'ingestTableUnpublished') {
                     this.#ingestBreaker.restore(ingestBreakerReason, Number(this.#controlGet('ingestBreakerRetryAt')), Number(this.#controlGet('ingestBreakerTrips')));
                 }
             });
@@ -690,6 +711,44 @@ export function createSyncDurableObject(config) {
                 'ON CONFLICT(key) DO UPDATE SET value = excluded.value ' +
                 'WHERE value <> excluded.value', [key, value]);
         }
+        // the set of tables this replica has actually received published changes
+        // for. it is the baseline that separates "the app never publishes this
+        // table" from "the feed stopped publishing a table we were syncing", and it
+        // has to survive eviction, so it lives in _zsync_host_control rather than
+        // an instance field. it only ever grows, and a write only happens the first
+        // time a table shows up.
+        #publishedSeenCache = null;
+        #publishedSeen() {
+            if (!this.#publishedSeenCache) {
+                const stored = this.#controlGet('publishedTablesSeen');
+                let names = null;
+                if (stored !== null) {
+                    try {
+                        names = JSON.parse(stored);
+                    }
+                    catch {
+                        names = null;
+                    }
+                }
+                this.#publishedSeenCache = new Set(Array.isArray(names)
+                    ? names.filter((name) => typeof name === 'string')
+                    : []);
+            }
+            return this.#publishedSeenCache;
+        }
+        #notePublishedTables(tables) {
+            const seen = this.#publishedSeen();
+            let added = false;
+            for (const table of tables) {
+                if (seen.has(table))
+                    continue;
+                seen.add(table);
+                added = true;
+            }
+            if (added) {
+                this.#controlSet('publishedTablesSeen', JSON.stringify([...seen].sort()));
+            }
+        }
         #controlDelete(...keys) {
             if (keys.length === 0)
                 return;
@@ -897,6 +956,12 @@ export function createSyncDurableObject(config) {
                 (page.nextCursor !== null && typeof page.nextCursor !== 'string')) {
                 throw new Error('invalid upstream snapshot page response');
             }
+            // a snapshot answer is upstream stating outright whether it publishes this
+            // table, which makes it the one place that can build a complete baseline:
+            // every modelled table is paged here, not just the ones that happen to be
+            // written while this replica is watching.
+            if (!page.unpublishedTables?.includes(table))
+                this.#notePublishedTables([table]);
             return page;
         }
         async #beginSnapshotGeneration(path) {
@@ -1011,8 +1076,21 @@ export function createSyncDurableObject(config) {
                         if (!Number.isSafeInteger(batch.watermark) || !Array.isArray(batch.changes)) {
                             throw new Error('invalid upstream changes response');
                         }
-                        for (const table of upstreamBatchTables(batch))
+                        const catchupUnpublished = unpublishedRegressions(batch, config.schema, this.#publishedSeen());
+                        if (catchupUnpublished.length > 0) {
+                            this.#tripIngest('ingestTableUnpublished', {
+                                phase: 'snapshot_catchup',
+                                generation: activeProgress.generation,
+                                cursor,
+                                batchWatermark: batch.watermark,
+                                changeRows: batch.changes.length,
+                                tables: catchupUnpublished,
+                            });
+                        }
+                        const catchupTables = upstreamBatchTables(batch);
+                        for (const table of catchupTables)
                             changedTables.add(table);
+                        this.#notePublishedTables(catchupTables);
                         this.#resetSnapshotBillingWindow();
                         const result = this.#withIngestBilling({
                             phase: 'snapshot_catchup',
@@ -1085,8 +1163,20 @@ export function createSyncDurableObject(config) {
                                 ? batchCommitTimeMs
                                 : Math.min(oldestLiveCommitTimeMs, batchCommitTimeMs);
                     }
-                    for (const table of upstreamBatchTables(batch))
+                    const unpublished = unpublishedRegressions(batch, config.schema, this.#publishedSeen());
+                    if (unpublished.length > 0) {
+                        this.#tripIngest('ingestTableUnpublished', {
+                            phase: 'changes',
+                            cursor,
+                            batchWatermark: batch.watermark,
+                            changeRows: batch.changes.length,
+                            tables: unpublished,
+                        });
+                    }
+                    const batchTables = upstreamBatchTables(batch);
+                    for (const table of batchTables)
                         changedTables.add(table);
+                    this.#notePublishedTables(batchTables);
                     const result = this.#withIngestBilling({
                         phase: 'changes',
                         cursor,

package/dist/write-safeguards.d.ts

@@ -1,4 +1,4 @@
-export type IngestBreakerReason = 'ingestBudgetExceeded' | 'ingestCursorStalled';
+export type IngestBreakerReason = 'ingestBudgetExceeded' | 'ingestCursorStalled' | 'ingestTableUnpublished';
 export type IngestBreakerOptions = {
     budgetRows: number;
     windowMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.16.14",
+  "version": "0.16.15",
   "description": "Internal orez Cloudflare sync host. Do not import directly: consumers use orez-lite/cloudflare/sync.",
   "type": "module",
   "exports": {
@@ -60,7 +60,7 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "orez-sync-executor": "0.16.14"
+    "orez-sync-executor": "0.16.15"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "4.20260617.1",